Issue logging into STAXX VM portal


HI, I wonder if you can help. I have setup a STAXX VM in VMWare Workstation which works just fine when I first set it up and it allows me to connect from the browser on my host laptop. The problem comes when I have to restart the VM and/or the laptop. When I then try to connect I get the login screen but every time I put in the correct credentials it just takes me back to the login screen without any error. I have reinstalled twice and get the same issue (works first time but not after a reboot).

I am using Firefox (Edge cant even see the login screen!)



Hello Phil,
I haven’t come across that symptom before.

Can you confirm the STAXX version you’re using? Are you able to test from Chrome?



I’m getting this issue also.

Running v2.5 in VMware fusion 8.5.8 , using Safari 10.1.1 and FireFox 54.0.1 on MacOS 10.12.5

Worked perfectly fine on v2.3


Hi, Seems this could be an issue around sessions.

Can you please try running the following command on the backend to see if this resolves the login issues in the GUI.

/opt/staxx/bin/xlink restart

Please let me know the outcome. Thanks



No change, even rebooted machine


Hi Stefan,

Thanks for the feedback. I would recommend that you open a ticket with support to further investigate this issue, you can do so by emailing Anomali Support:

When opening a support ticket please supply a set of logs. Thanks



One thing to note here is that we test on the supported STAXX hypervisors, namely:

  • VMware ESXi server v6.0
  • Oracle Virtual Box 5.0 VM
    Other hypervisors, even VMware ones may not be as stable for STAXX. It will be good to hear if other STAXX users are experiencing these symptoms, and on what hypervisor.


It looks like I have same issue. I run this VM on Oracle Virtual Box 5 and have minimum requirement available for this machine.
I can’t login to portal, if I use bad credentials, I got bad message. If I use good credentials, I got login page again.
I don’t find something useful in log files too. xlink.log contain only requests to web page and some other informational events.
[2017-11-03 19:33:51,213] [INFO ] [03/Nov/2017:19:33:51] ENGINE Started monitor
thread ‘Session cleanup’.
[2017-11-03 19:33:51,217] [INFO ] SELECT, first_name, last_name, l
ogin_name, password, email, organization, group_id, extract(epoch from date_trun
c(‘second’, modified_ts)::timestamp)::integer as date, profile::json, external_i
d, approved, version_read_new_features FROM xlink_user, xlink_user_preferences W
HERE = xlink_user_preferences.user_id AND login_name=%s
[2017-11-03 19:33:51,240] [INFO ] - - [03/Nov/2017:19:33:51] “POST /lo
gin_request HTTP/1.1” 200 60 “” “Mozilla/5.0 (X11; L
inux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0”
[2017-11-03 19:33:51,259] [INFO ] - - [03/Nov/2017:19:33:51] “GET / HT
TP/1.1” 303 95 “” “Mozilla/5.0 (X11; Linux x86_64; r
v:52.0) Gecko/20100101 Firefox/52.0”
[2017-11-03 19:33:51,295] [INFO ] - - [03/Nov/2017:19:33:51] “GET /log
in HTTP/1.1” 200 958 “” “Mozilla/5.0 (X11; Linux x86
_64; rv:52.0) Gecko/20100101 Firefox/52.0”



Sorry for the late reply but for anyone that comes across this issue in the future it may be caused by your VM being out of sync with NTPD. Steps to solve this are as follows:

  1. Log into your Staxx CLI
  2. Run the following command: sudo service ntpd stop; sudo ntpdate; sudo service ntpd start




Had this issue a while back. Resolved it (can’t remember how for the life of me but it did not involve the ntp server and restarting xlink didn’t help). Sadly I’m facing the same issue again today… guess I should have done a better job of documenting my t-shooting steps.

@phil.doyle did you ever open a ticket like they recommended? If so did (assuming the issue was resolved) can you recall and do you mind sharing the fix action?